From 5fed4ceaff499fad7cc962c6a7cc6d8749b166c7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mateusz=20Burzy=C5=84ski?= <mateuszburzynski@gmail.com>
Date: Sat, 16 May 2026 15:17:29 +0200
Subject: [PATCH 1/2] Call CI workflow before publish attempt

---
 .github/workflows/ci.yml      | 1 +
 .github/workflows/publish.yml | 8 ++++++--
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0d8a46b1f..4d73b5b91 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,6 +1,7 @@
 name: CI
 
 on:
+  workflow_call:
   pull_request:
   # merge queue is required so all commits on target branches trigger this workflow
   # despite lack of the push event trigger here
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 99afb51e7..03752a4d5 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -43,10 +43,14 @@ jobs:
         with:
           version: pnpm version-packages
 
-  publish:
-    name: Publish
+  ci:
     if: needs.version.outputs.hasChangesets == 'false'
     needs: version
+    uses: ./.github/workflows/ci.yml
+
+  publish:
+    name: Publish
+    needs: ci
     runs-on: ubuntu-latest
     environment: npm
     timeout-minutes: 20

From a55615b2618a2a54b24e495ddb8c1374d8ecab34 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mateusz=20Burzy=C5=84ski?= <mateuszburzynski@gmail.com>
Date: Sat, 16 May 2026 15:39:01 +0200
Subject: [PATCH 2/2] tweak

---
 .github/workflows/ci.yml      | 5 +----
 .github/workflows/publish.yml | 2 ++
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4d73b5b91..dd1705520 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -47,9 +47,6 @@ jobs:
   lint-workflows:
     name: Lint workflows
     runs-on: ubuntu-latest
-    permissions:
-      actions: read # only required in private repos
-      security-events: write # allow writing security events
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -100,7 +97,7 @@ jobs:
 
       - name: Upload coverage
         uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
-        if: matrix.node_version == 24
+        if: matrix.node_version == 24 && github.event_name != 'workflow_call'
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 03752a4d5..46a22ded5 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -46,6 +46,8 @@ jobs:
   ci:
     if: needs.version.outputs.hasChangesets == 'false'
     needs: version
+    permissions:
+      contents: read
     uses: ./.github/workflows/ci.yml
 
   publish: